openskills.info
Course catalog
Cilium logoCourse Preview

Cilium

Cilium is a Kubernetes networking, observability, and security project that uses eBPF to enforce policies and route traffic at the Linux kernel level. It provides high-performance pod networking, transparent encryption, and identity-based access control without sidecar proxies.

itCloud native tools and technologies

Cilium

Cilium is a networking, security, and observability platform for Linux and Kubernetes. It uses eBPF programs in the Linux kernel to connect workloads, load-balance services, enforce policy, and expose network behavior.

The central mental model is identity-aware control attached to the network path.

Kubernetes intent             Cilium control plane
pods, services, policies ---> agents and operator
                                  |
                                  v
application traffic ------> eBPF datapath ------> destination
                                  |
                                  +------> Hubble flow data

Cilium can be your Kubernetes Container Network Interface plugin, or CNI plugin. It can also replace kube-proxy, enforce extended policies, provide Hubble observability, connect clusters, encrypt traffic, and implement Gateway API routes. Those features share a datapath, but you do not need to enable them all.

Why Cilium exists

Kubernetes workloads appear, disappear, and move between nodes. Their IP addresses change with them. A rule system built only around changing IP addresses can become difficult to operate at cluster scale.

Cilium assigns security identities to endpoints based on labels. Policy can then describe which workload identities may communicate. The datapath enforces that decision as traffic crosses kernel hooks.

This separates security intent from a specific pod IP. It also connects networking and observability. The same datapath that forwards or drops traffic can report what it observed and why.

eBPF makes this model possible. eBPF lets verified programs run at defined hooks inside the Linux kernel. Cilium loads programs at networking hooks and supplies them with state held in eBPF maps. The kernel executes those programs as packets or socket operations reach the hooks.

You do not write eBPF programs to use Cilium. The Cilium agent translates cluster state and configuration into datapath programs and map entries.

The main components

A typical Kubernetes deployment has several cooperating components.

The Cilium agent

The Cilium agent runs on each node. It watches Kubernetes events, manages local endpoints, loads eBPF programs, updates maps, and exposes local health and debugging information.

The agent is close to the datapath because each node must make forwarding and policy decisions for its own traffic. A broken agent can affect new configuration on that node even when already-loaded datapath state continues to exist.

The Cilium operator

The operator handles cluster-wide control-plane work that should not run independently on every node. Its exact responsibilities depend on enabled features. Examples include address-management tasks and processing resources for some service features.

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources